ISAE 3000: the standard for non-financial assurance

ISAE 3000 is the overarching international standard for assurance engagements over non-financial information. Whereas ISAE 3402 deals specifically with outsourced processes that are relevant to financial reporting, ISAE 3000 provides a broader framework for assurance over virtually any subject matter.

The full name is ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information. The standard was issued by the IAASB and forms the foundation on which more specific standards such as ISAE 3402 and ISAE 3410 are built.

In practice, ISAE 3000 is used for assurance engagements in areas such as information security, sustainability, privacy, quality management and IT management. Consider an assurance report on compliance with the GDPR, a statement on the operation of an information security management system, or assurance over a sustainability report.

The difference between ISAE 3000 and ISAE 3402 is fundamental. ISAE 3402 is intended solely for service organizations and concerns controls that are relevant to the financial reporting of their clients. ISAE 3000 does not have that limitation and can be applied to any subject matter over which an organization wishes to provide assurance.

ISAE 3000 distinguishes two levels of assurance. In a reasonable assurance engagement, the auditor issues a positively worded opinion: the controls operate effectively. In a limited assurance engagement, the auditor issues a negatively worded opinion: nothing has come to our attention that indicates the controls do not operate effectively. Reasonable assurance requires more testing work and provides a higher level of assurance.

SOC 2 reports are technically based on AT-C 205, the American equivalent. In Europe, an increasing number of organizations opt for an ISAE 3000 report as an alternative to, or supplement to, SOC 2, particularly when the scope is broader than the five Trust Services Criteria.

For Dutch organizations that wish to provide assurance over their information security, privacy compliance or other non-financial subject matter, ISAE 3000 is the standard of choice. The report offers stakeholders independent assurance without the limitations of ISAE 3402.

Secure Audit performs ISAE 3000 assurance engagements in the areas of information security, IT management and compliance. Contact us to discuss which standard best fits your situation.